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There are two concerns being expressed about IDW in the article. One deals with 
whether the FBI has complied with the Privacy Act's requirement to publish a "systems 
notice" in the Federal Register and the other is whether the FBI has complied with the 
privacy impact analysis requirements of the "E-Govemment Act." 

The answer to the first question is "yes." We consider IDW to be part of the FBI's 
Central Record System, an "umbrella" system that is comprised of all of the FBI's 
investigative files. While it is true that "IDW" isn't specifically mentioned in the CRS 
Privacy Act System Notice, we don't believe that is necessary. The system notice does 
state: "In recent years ... the FBI has been confronted with increasingly complicated 
cases, which require more intricate information processing capabilities. Since these 
complicated investigations frequently involve massive volumes of evidence and other 
investigative information, the FBI uses its computers, when necessary to collate, analyze, 
and retrieve investigative information in the most accurate and expeditious manner 
possible." The system notice describes in reasonable detail what information we obtain, 
what routine uses we make of it, the authorities for maintaining the system and so forth. 
This notice is published in the Federal Register and is publicly available. In our view, 
we are compliant with both the letter and spirit of the Privacy Act in this regard. 

The answer to the second question is also "yes." In fact, since IDW has been categorized 
as a "national security system," the E-Government Act does not require it to undergo a 
privacy impact analysis (PIA) at all. Even so, FBI and DOJ policy requires a PIA to be 
conducted. For IDW, the FBI has done several PIA’s. We did one for the original system 
and did others as significant data sets were added to IDW. None of these systems were 
published since the law does not require them to be conducted in the first place. The 
point is that we have done far more to analyze the privacy implications of IDW than the 
law requires. Yes, the analyses have not been conducted in the public domain but 
Congress weighed the costs and benefits of conducting such an analysis in public and 
chose to exclude national security systems from that requirement when it passed the E- 
Govemment act. 



